Reserve space for the termination NUL after the maximum 20 decimal
digits of a long long value to avoid buffer overflow in sprintf().
Fixes: f5db4af466e2 ("dm raid1: add userspace log")
Cc: [email protected]
Signed-off-by: Ilya Krutskih <[email protected]>
---
drivers/md/dm-log-userspace-base.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/dm-log-userspace-base.c
b/drivers/md/dm-log-userspace-base.c
index 9fbb4b48fb2b..fda97368a72b 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -139,6 +139,7 @@ static int build_constructor_string(struct dm_target *ti,
str_size += strlen(argv[i]) + 1; /* +1 for space between args */
str_size += 20; /* Max number of chars in a printed u64 number */
+ str_size++; /* For NUL-terminator */
str = kzalloc(str_size, GFP_KERNEL);
if (!str) {
--
2.43.0
